Add increased account security

Support Feature Requests
1

Describe your feature request
Add more ways to increase the security of your Replit account with things like 2FA with an authenticator app or SMS codes.

What problem(s) would this feature solve?
This would make it so it would be harder to compromise accounts especially if somebody does a lot of bounties and has thoughts of dollars of cycles sitting in their account.

Explain what you were trying to do when you came across the problem leading to this feature request
Nothing really. I was thinking with the new SSO here there is no more 2FA like it was before with more vanilla discourse and now there is none directly in Replit.

8 Likes
2

Interesting idea, I like it! However, you could setup logging into Replit via an Apple, Google or GitHub account with MFA enabled on that.

2 Likes
3

You can log in to Ask with nothing but an SID as far as I know, so wouldn’t that allow bypassing 2FA?

4

You can do that with ask AND mainsite

1 Like
5

True, but you can do that for any service that doesn’t expire your session. As long as you don’t share your SID or get it stolen it’s fine.

2 Likes
6

Wouldn’t 2FA be useless without having every destructive action need 2FA? Currently deleting an account doesn’t need 2FA, for example. (It doesn’t require any authentication at all as far as I know)

2 Likes
7

You’re right - it doesn’t require auth. My point was just to help with logging in. Nothing you can do about anything else.
It is really stupid. YouTube also doesn’t require auth for lots of things they should (like unlisting videos, deleting them, streaming, etc) which leads to a lot of the scam channels that have been hacked or had the browser session stolen. Same on lots of websites unfortunately.

1 Like